The communications industry is rapidly changing to adjust to emerging technologies and ever increasing customer demand. This customer demand for new applications and increased performance of existing applications is driving communications network and system providers to employ networks and systems having greater speed and capacity (e.g., greater bandwidth). In trying to achieve these goals, a common approach taken by many communications providers is to use packet switching technology. Increasingly, public and private communications networks are being built and expanded using various packet technologies, such as Internet Protocol (IP).
For service providers, network security is a matter of business survival. Security incidents due to viruses, intrusion, operator error, and software configuration error can involve extensive associated costs and consequences such as service disruption, financial loss, dissatisfied customers, reduced productivity, and even media attention. To protect their revenue and profits, service providers must protect their infrastructures and offer managed services for secure connectivity, threat defense, and endpoint protection.
To maintain high availability in an environment of increasing security threat (for example, distributed-denial-of-service [DDOS] attacks) and policy complexity, service providers are looking to new routing and switching solutions—solutions that offer effective and embedded, hardware-based security instrumentation that enables self-defending networks.
The control plane is where all routing control information is exchanged, making the control plane and its components a target. Because control plane resiliency depends on CPU processing power and scalability, “out-of-resources” attacks against the CPU are not uncommon. To support scalability and performance, a paper entitled “Cisco CRS-1 Security”, Cisco Systems, Inc., May 2004, (which is hereby incorporated by reference in its entirety) teaches that a control plane of a router can be designed with distributed and redundant route processors that use symmetric multiprocessing (SMP) CPUs. Cisco CRS-1 Security, Cisco Systems, Inc., May 2004. Under normal operations, the router transit traffic is processed by its line cards at wire rate. However, exceptions occur when packets are directed to the router itself. These “punted packets,” which include routing protocol, Internet Control Message Protocol (ICMP), and network management packets, are directed from the line card packet processor to either the line card CPU or route processor CPU. To safeguard the control plane against DoS attacks in an open environment, multiple, layered security features can be distributed to the line card and its packet processors, with these features including: dynamic control plane protection (DCPP), automatic control plane congestion filter, control plane time-to-live (TTL) sanity check (RFC 3682, Generalized TTL Security Mechanism (GTSM), Border Gateway Protocol (BGP) routing protocol filtering, and Route Policy Language (RPL).
Unauthorized or deliberately malicious routing updates caused by violations such as an intruder diverting or analyzing network traffic can compromise network security. Implementing neighbor router authentication with Message Digest Algorithm 5 (MD5) is a common way to avoid spoofing, and it virtually ensures that the router receives reliable information from a trusted source—but it is only a first step. If spoofed BGP packets start spraying toward the router, receive-path access control lists (ACLs) and modular QoS CLI (MQC) rate limits control exactly where these packets can proceed. However, ACL and MQC controls are not automated. If BGP peers go down or restart, the Layer 4 port number changes with each session reestablishment. As a result, network designers have been asking for an automated, dynamic way to permit configured BGP peering sessions and drop non-configured sessions.
In response, a router can offer a DCPP scheme for line card packet processing. With DCPP, explicitly configured BGP peering sessions are automatically allocated adequate resources, whereas non-configured sessions are rejected or given minimum treatment. This permit-deny model is based on the association of statically configured IP addresses and dynamic Layer 4 port numbers. Prior to authentication and establishment for maximum admission control, different resource policies exist for initial connections. Control plane packets have to go through multilayer, prescreening schemes until they are authorized through an internal lookup table and allocated adequate resources. This automation frees time spent by network administrators on manual configuration for use on other mission-critical tasks.
Under extreme DoS or DDoS attacks that cause line cards to exceed router slot capacity, control mechanisms perform at hardware application-specific integrated circuit (ASIC) rate, beyond line card capacity, to drain packets into the Silicon Packet Processor (SPP) on the Layer 3 Modular Services Card (MSC) and assure control plane packet-processing priority. This feature maintains topology while the network administrator uses other security tools to install mitigation schemes to solve the problem.
Most control protocol peering sessions are established between adjacent or directly connected routers. Prior to GTSM (formerly known as BGP TTL Security Hack [BTSH]), BGP packets directed at the router from non-directed peering points had to be processed by the router CPU. When enough of these packets were generated, it effectively created a massive DDoS attack that exhausted CPU resources. Now, with GTSM, a TTL check on BGP peering packets can effectively block all nondirected BGP spoofing in MSC SPPs.
These techniques may also be applied to many other applications, such as Label Distribution Protocol (LDP) and Resource Reservation Protocol (RSVP), which can take advantage of the features of generalized GTSM. Because of the fully programmable MSC architecture in the router, GTSM support for other application protocols can be easily added to MSCs.